Your data. Your keys. Your kill switch.
Scoped OAuth
Minimum scopes per platform. No full-access tokens. Every scope disclosed before you authorize.
Encryption everywhere
AES-256 at rest, TLS 1.3 in transit. Backups encrypted with per-customer keys.
Audit logs
Every action logged with actor, timestamp, and payload. Immutable, exportable, queryable.
Zero PCI scope
Omesta never sees card numbers. Stripe handles PCI. We read recovery signals, not payment instruments.
Requested permissions
Omesta never stores card numbers or moves money.
What we can access. What we explicitly cannot.
Data encryption
Every byte encrypted at rest and in transit with industry-standard algorithms.
Audit trail
Immutable, timestamped log of every action taken on your account.
OAuth token rotated for Stripe
2 min ago
Audit log exported by admin@acme.co
14 min ago
Ad-pause scope enabled for Meta
1 hr ago
Read-only token issued for Google Ads
3 hr ago
Kill switch tested by ops@acme.co
6 hr ago
Access control
Read-only OAuth scopes per integration. Every permission disclosed upfront.
Compliance
Industry certifications and regulatory compliance. Audit letters available on request.
How your data moves. Encrypted at every step.
Encrypted data pipeline
Read-only data flows from your platforms through encrypted channels to your dashboard.
Security metrics
Real-time security posture at a glance.
Who touches your data. Where it lives.
Opt-in writes
Every action category is opt-in. Every change is reversible from the dashboard.
Kill switch
One-click revocation that purges your tokens in under 60 seconds.
Single-tenant data
Each customer's data lives in its own logical database. No cross-tenant queries.
All systems operational
SOC 2 Type II
Audited annually. Letter available under NDA. ISO 27001 in progress.
GDPR ready
DPA available in 1-click sign from account settings. EU data residency on request.
Zero standing access
No Omesta employee has standing access. Every query logged with ticket link.
Third-party verified. Regularly tested.
Certifications
Audit reports and compliance documents available under NDA. One-click DPA from account settings.
SOC 2 Type II Report
Audit period: Jan 2025 – Dec 2025
Penetration testing
Annual third-party pen tests with quarterly vulnerability scans. Summary available on request.
Annual pen test completed — 0 critical findings
Apr 2026
Remediation verified for 2 medium-risk items
Mar 2026
Scope expanded to include new Meta integration
Feb 2026
Quarterly vulnerability scan — clean
Jan 2026
Security questions? Talk to our team.
Our security team will gladly answer any question your CISO has before you connect a single thing.